outgoing LAN traffic always in "keep state"

Ronnel P. Maglasang rmaglasang at infoweapons.com
Mon Jun 19 02:17:11 UTC 2006


I have a minimum PF setup that sits in between my internal network(lan)
and external network(wan). PF by design, bypasses ruleset evaluation(on
external interfaces) for incoming packets on external interface that 
corresponds
to an entry in the state table or a response to an internal generated 
packet.
I observe this for TCP, UDP and also ICMP packets. Even if the matching rule
in the internal interface do not have a "keep state", still the response 
packet
bypasses the ruleset evaluation. Is there a way (force) to allow response
packets to go thru ruleset evaluation? I just want to have full control of
the incoming packets on the external interface wether they are response to
a LAN traffic or not. I'll be implementing queueing soon and I think this
PF behavior will affect badly. Has anyone experienced this?

Thanks a lot.
- sho


More information about the freebsd-pf mailing list